Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI is warning people against using public phone-charging stations

schneier.com

Post reply on HN
Print view View original

51–60 of 328 posts

Re: FBI is warning people against using public phone-charging stations

#51

Post by HeavyFeather »

imdoor wrote: post #49

I'm curious, shouldn't the "charge only" mode, that's the default, when connecting usb stuff to Android phones, be enough to protect users? Is it really that difficult to implement a "don't read data pins, only charge" mode on a phone and not have vulnerabilities in it?

If you can connect your turned off phone to your computer and start a reset, then that’s never going to be enough.

If you want data safety, you must skip the data pins.

If you want current safety, you must skip public chargers.

Re: FBI is warning people against using public phone-charging stations

#52

Post by fnordpiglet »

rlpb wrote: post #46
i-am-gizm0 wrote: post #5

Earlier quoted context omitted.

At least on AC Level 1/2 charging (using just a J1772 port) the signalling is pretty rudimentary if I remember correctly. Something along the lines of the car puts out a square wave on one of the signalling pins and based on the resistance it sees it knows whether it's plugged in and how much power it can charge, so there isn't much room (dare I say any) way to interact much with the car through that port. I don't kn…

When I've done DC rapid charging on my Leaf, I noticed that the charger knew the battery percentage reported by the car. That seems likely to be digital signalling to me, so suddenly there's the risk of buffer overflows and suchlike. I've not seen this on AC, but when I looked into this previously I got the impression that there exists a digital signalling protocol established by modulating something ignored by older…

That’s why I only buy cars written in rust.

Re: FBI is warning people against using public phone-charging stations

#54

Post by ghaff »

dwringer wrote: post #44
causi wrote: post #4

Earlier quoted context omitted.

Seriously need an edited title then. Original title is wildly misleading.

I agree - the only "public charging stations" I see on any kind of regular basis are EV charging stations. It's been a couple of decades since I remember seeing a USB one, not that I doubt their existence.

They're ubiquitous at conferences and in many trains, planes, airports, hotels, etc. Maybe you mean something different by public but USB charging stations that you don't control are very common especially in the context of places travelers are in. They're probably pretty common in schools, libraries, conference rooms, etc. as well.

Re: FBI is warning people against using public phone-charging stations

#55

Post by 13of40 »

LinuxBender wrote: post #3
chaorace wrote: post #2

Just FYI: this is referring to USB charging stations, not EV stations. This advice has been standard in cybersecurity training for a long time now and frankly I'm surprised that this is the first time the FBI has felt the need to issue an advisory on the subject.

I have been somewhat curious if/when this will occur with EV stations as well. What controls might one gain over a car from the charging port on the assorted makes/models? Even hacking aside I am curious what PII, telemetry and tracking data could be pulled from the charge port.

I wonder if dealerships and other auto shops behave like every other company today, and when they plug into your OBD2 port they just hoover up as much data as they can and sell it off.

Re: FBI is warning people against using public phone-charging stations

#56

Post by bakugo »

shiftpgdn wrote: post #20

If you have a zero day takeover via usb/lightning why would you waste it on public charging infrastructure? That seems ridiculous.

I'm inclined to agree, an exploit this powerful would almost definitely be used for targeted attacks only.

Re: FBI is warning people against using public phone-charging stations

#57

Post by HeavyFeather »

layer8 wrote: post #41
trinsic2 wrote: post #31

To block usb power connectors from owning your phone: Databloc USB Data Blocker Adapter https://www.amazon.com/Databloc-Charge-Only-Adapter-syncing-...

Nice. Alas, that will probably also block fast charging on iPhone 15+: https://9to5mac.com/2023/03/20/usb-c-faster-charging-iphone-...

Idea: use a power bank that allows in/out at the same time. It should charge both at high speed while also acting as a firewall.

This is also assuming that your powerbank can’t be hacked. In which case, god save us all.

Re: FBI is warning people against using public phone-charging stations

#58

Post by jsheard »

layer8 wrote: post #41
trinsic2 wrote: post #31

To block usb power connectors from owning your phone: Databloc USB Data Blocker Adapter https://www.amazon.com/Databloc-Charge-Only-Adapter-syncing-...

Nice. Alas, that will probably also block fast charging on iPhone 15+: https://9to5mac.com/2023/03/20/usb-c-faster-charging-iphone-...

Same with Android, the various fast charging protocols use the data pins to negotiate the voltage setting and how much current the phone is allowed to draw. I suppose in theory you could make an active dongle which MITMs the data pins and strips anything it doesn't recognise as a valid fast charging command, but I don't know if such a product exists.

Re: FBI is warning people against using public phone-charging stations

#59

Post by rtkwe »

vegardx wrote: post #45
rtkwe wrote: post #10

Earlier quoted context omitted.

The really high voltage fast chargers as far as I understand them connect directly to the battery bypassing the cars battery charger to directly charge the battery not sure how much communication there is on those channels though.

You're probably thinking about the on-board inverter, it's often referred to as a battery charger. The battery management system is entirely within the car, and the car will tell what voltage and amperage to deliver to it. The design of CCS2 is actually quite nice. There are pins for singalling that, if broken, will immediately shut down power delivery. This means that you can just pull the cable out safely, without…

My understanding was it also bypassed the BMS but I may have confused what they were saying it's been a minute.

Re: FBI is warning people against using public phone-charging stations

#60

Post by ghaff »

jjulius wrote: post #48
jrochkind1 wrote: post #32

I'm surprised Schneier says "I am unconvinced". We know (I think?) attackers can apparently easily introduce MitM skimmers to credit card swipers (I _think_ that's how my CC number keeps getting stolen?), possibly even without cooperation of the proprietor? Why not a little invisible injector on a charging port, that seems if anything easier. Or is the skepticism around something else, I guess? Motivation? Lack of co…

>I'm surprised Schneier says "I am unconvinced". And immediately after he says he's unconvinced this is a concern, he states that he does, in fact, carry a tool with him that would protect him in these circumstances.

In general, you can be unconvinced that various things are actually a meaningful real-world danger, but you choose to mitigate against them anyway if you can do so easily.
Post reply on HN